hAP ax²

The hAP ax² (part number C52iG-5HaxD2HaxD-TC) is the middle of the hAP family: the same kind of processor and radios as the ax³, without the fast port and without PoE-out. It suits a flat, a study or a small office on a gigabit line or slower, and anyone who wants one device that routes and broadcasts Wi-Fi.

This model's data has been checked against real hardware, so the port names and radios in your script match what is printed on the case.

The ports

Five ethernet ports, ether1 to ether5, all 1 Gbit. ether1 is the WAN port by default, so your ISP's cable goes there and the other four are LAN. There is no SFP port and nothing faster than a gigabit.

This model has no PoE-out, so the PoE-out per port field does not appear in the configurator at all. An access point or camera on one of these ports needs its own power supply or a separate PoE injector.

A different network per port is no problem: VLANs with access and trunk ports work here, and the switch chip keeps bridge VLAN filtering in hardware. See VLANs and Bridge and ports.

Wi-Fi

Two radios: wifi1 on 5 GHz and wifi2 on 2.4 GHz. RouterOS v7 uses the new wifi package for this model, so your Wi-Fi lives under /interface wifi with the names wifi1 and wifi2.

What follows from that:

• Examples using /interface wireless and wlan1 belong to older devices and will not work here. The configurator writes the right form by itself.
• Central management of several access points goes through /interface wifi capsman, not the older /caps-man. See CAPsMAN.
• You can attach a VLAN to each SSID, for instance to keep guests or IoT away from your own network.

At home one name across both bands is usually the practical choice; your devices pick for themselves. Only gear that insists on 2.4 GHz sometimes needs a name of its own. The rest is in Wi-Fi settings and Channels and width.

What it is good at, and where it runs out

A 64-bit ARM processor with 1 GB of memory and an IPQ-6010 switch chip. That is the same room as in the ax³, and it is plenty for firewall rules, VLANs, DHCP leases and a DNS cache. The RouterOS licence level is 4, which among other things decides how many tunnels you may run at once: rarely a problem at home, worth counting in an office full of VPN users.

The practical ceiling is the traffic that has to go through the CPU. With FastTrack on, most traffic is steered around the processor and the box keeps up with its ports. Switch QoS on with a queue tree and FastTrack goes off, so everything runs over the CPU; the configurator warns you when that happens. A WireGuard tunnel is encrypted in software and therefore carries a good deal less than your plain internet connection. We do not put numbers next to that: measure it on your own device with your own traffic.

The other ceiling is cabling. Five gigabit ports are enough for a small network, but once you have a NAS, a switch and a few desks you are out of ports, and it becomes a hEX S, an L009 or an RB5009.

Which roles fit

• Home router: what this model was built for.
• Office router with VLANs: workable, it has ports enough for a WAN, some desks and a trunk to a switch.
• Access point or CAP: a good second career when there is already a router. Everything bridged, a management address, Wi-Fi of its own or from a controller.
• Wi-Fi repeater: possible, but expect at most half the throughput.
• VPN gateway: works, with the speed and licence caveats above.

The LTE / 5G router role does not appear: there is no modem in this device.

The quickest route to a working script

1. Choose One device, search for ax2 and pick the Home router role.
2. Fill in your internet connection: DHCP or PPPoE, optionally through a provider preset.
3. Fill in SSID, passphrase and country, plus an administrator password.
4. Reset the device, paste the script over a cable and log back in.

The route is written out in Example: replacing the ISP router, and pasting itself in Using the script.

What trips people up

• Mixing it up with the ax³. The ax³ has 2.5 Gbit on ether1 and PoE-out on ether5; the ax² has neither. Pick the model you actually own, or your script will configure ports that do not exist in that shape.
• An example for the wrong Wi-Fi package. Anything using /interface wireless belongs to a different kind of device. Coming from v6? Read From v6 to v7.
• Pasting the script over Wi-Fi. The radios are reconfigured during the import; use a cable.
• Counting on PoE. No power comes out of these ports, ether5 included.